Maximum password length: DOS Potential

lulzdev

An excerpt from: http://www.tomsguide.com/us/django-long-password-security,news-17557.html

"A double-edged sword

In the case of a brute-force attack, the attacker is trying to gain access to the system. But the developer found that if the attackers are just trying to mess things up, they could go to Django's login page and repeatedly submit hundreds of extremely long "junk" passwords of thousands of characters or more.

Having to check all these junk passwords against the stored cryptographic hashes puts a heavy strain on Django's system and eventually overtaxes it.

The result is essentially a denial-of-service attack, which is when attackers bombard a server with website hits or other requests that, when combined, eventually bring the server offline.

There haven't been any known attacks that used this method. Nevertheless, Django has since patched this vulnerability by setting a limit on password length: 4096 bytes, or around 4,096 of the characters found on a keyboard. The updated version is available on Django's website. So what's the takeaway? Users should keep using long passwords. Developers, however, should be aware that strong password security could become a double-edged sword."

Going through the admin options and realized that there is not an option for a maximum password length.

I have seen, previously, this feature having its purpose questioned (https://github.com/NodeBB/NodeBB/issues/261), indicating it used to be a thing.. however it does not appear to be now. Does anybody know why?

bentael

we could enable CAPTCHA after N number of failed logins, kind of what most sites do.

lulzdev

That is not a bad idea. My concerns lie in the creation of an account where it has you make a password.

I barely know what I am talking about, buy in theory 1 very large string could cause some performance issues on the server end. Whether that be from encrypting, storing, or pulling the password.

I have seen 14 gig notepad documents with just strings of characters for Brute forcing, so I suppose the same could be used for initiating a Denial of Service.

Robert

@lulzdev I guess most of us can do it try the theory out, even mathematical if that's needed. But its indeed a interesting topic to have.

psychobunny

https://github.com/NodeBB/NodeBB/issues/4041

I think this is a reasonable solution for this problem

bentael

This post is deleted!

bentael

@lulzdev we do enable CAPTCHA on registration as well.

bentael

Also, express bodyParser has a default limit of 100kb,
https://github.com/expressjs/body-parser#limit

psychobunny

Yeah the issue is for login (no captcha there) which asks bcrypt to hash whatever comes in, even at 100kb limit, it could potentially be abused

bentael

@psychobunny what about showing a captcha after 2 or 3 failed logins?

lulzdev

Appreciate the responses.
If login is where the potential lies, then CAPTCHA would certainly take care of it.

psychobunny

@bentael said:

@psychobunny what about showing a captcha after 2 or 3 failed logins?

Yup that works